jerry @jerry

**Jan Wildeboer** @jwildeboer@social.wildeboer.net · Feb 19 *

Jan Wildeboer @jwildeboer@social.wildeboer.net

"if you need a tool to communicate privately with your friends and family–even if your chats are boring, mundane, and totally legal–#Signal is the best damn choice I can recommend."

is the conclusion after 6 parts of detailed and well explained code review that starts at https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/ by @soatok

(Yes, I read all 6 parts. No, I don't claim to understand more than the basics of cryptography, which is why yes, I have to and do trust the author on their conclusions)

Our Review Roadmap

Given what we’ve covered above, the targets of interest are as follows:

1. The Rust implementations of cryptography in libsignal.
- Libsignal uses curve25519-dalek under-the-hood.
- For actual encryption, they use a lot of RustCrypto.
- Key transparency is relatively new, and of particular interest to me.
- The actual Signal protocol, which now uses post-quantum cryptography.
- The zkgroup and zkcredential features, which involve zero-knowledge proofs and are paramount to Signal’s server software not being able to know who is in which group.
- The account keys and usernames features, since the privacy surrounding phone numbers is important to most Signal users.
- Secure Value Recovery v3. If we can find a vulnerability in a recovery system, that will definitely be high-impact.
2. The bridge code, which enables libsignal to be used in other programming languages.
3. Cryptography implemented in Signal for Android, where it doesn’t just punt to libsignal.
4. Cryptography implemented in Signal Desktop, ditto.
5. Cryptography implemented in Signal for iOS, as with the previous two.

Feb 19 *

**Kevin Karhan** @kkarhan · Feb 24

Kevin Karhan @kkarhan

@soatok @jwildeboer I still disagree because it completely ignores @signalapp being #centralized, #SingleVendor & #SinglePrivider, demanding #PII in the form of a #PhoneNumber, being able and willing to restrict functionality based off that and being subject to #CloudAct.

And with #Trump's regime going apeshit, the #USA are more and more a #risk factor!

#trump #usa #risk

Feb 24

**Ferdi Magellan** @FerdiMagellan@aus.social · Feb 24

Ferdi Magellan @FerdiMagellan@aus.social

@kkarhan @soatok@furry.engineer @jwildeboer @signalapp what do you use?

Feb 24

Kevin Karhan @kkarhan@infosec.space

@FerdiMagellan @jwildeboer @soatok I use #XMPP+#OMEMO, more specifically, @monocles / #monclesChat & @gajim / #gajim!

https://docs.monocles.eu/apps/chat.app/

Another option that may be interesting if you are a business/org & need archival support (and have existing #eMail infrastructure) is @delta / #deltaChat, which is easy to bring into #compliance with #GoBD / #HGD and similar #Archival mandates for professional/business comms.